HUSKY Health breach: 41,000 Connecticut members and what DSS confirmed

On August 21, 2026, the Connecticut Department of Social Services said Gainwell Technologies — the company that processes HUSKY Health payments — found unauthorized access to certain payment accounts on the HUSKY provider portal. Gainwell learned of it on June 25, 2026. The state says the outsider first got into a provider’s reimbursement account on June 18, 2026.

DSS says that person obtained claims and payment information for about 41,000 HUSKY members: full name; an identification number tied to the provider’s payment account or a Medicaid claim; dates of medical services; information about services received and how they were billed; amounts paid; and, where it applied, other health insurance policy and group numbers. Electronic health records, Social Security numbers, and financial account information were not taken. Letters to affected people started going out by postal mail on August 21, 2026, with an offer of credit and identity monitoring. DSS has not reported evidence that the information was misused. This is the second HUSKY/Gainwell provider-portal incident in 2026; a separate May notice covered about 22,500 people.

The part most coverage will undersell

Almost every account of this incident will lead with what was not taken: no Social Security numbers, no bank accounts, no electronic health records. That is true, and it is better than the alternative. It is also the least useful sentence if you are trying to decide whether this touches your life.

What the outsider actually has, according to the state, is a named list of HUSKY members plus the billing trail of their care — when services happened, what was billed, what was paid, the numbers used to process those claims, and, for some people, the policy and group numbers of their other insurance. That is not your doctor’s chart. It is the invoice of your care, with your name on it.

Someone who has that can call and mention a real visit or a real payment and sound like HUSKY, a clinic, or a billing office. They can also try to bill new services using a real claim number and a real other-insurance policy number. DSS said the activity looked financially motivated, not aimed at collecting patient files. That is not comfort. It means they took the file that is useful for billing fraud and for a call that already knows too much about you.

No public scan can tell you whether you were in this specific incident. The only official signal is the letter DSS said it began mailing on August 21, 2026.

What to actually expect

• If you were included, a letter by U.S. mail — not a surprise text, not a cold call — offering free credit and identity monitoring and fraud support. Mail can run late or go to an old address, so a delay is not proof either way.
• A second, separate paper trail if you were also in the May 2026 incident (about 22,500 people). That was a different notice about the same kind of portal. Do not assume one letter covers both.
• Calls, texts, or emails that already know you are on HUSKY, a service date, or an amount paid. Treat those as scams. The state’s own notice is a letter.
• No reset of your Social Security number or bank login. Those were not in this file. The live risk is someone using your claim or other-insurance numbers, or using the details of your care to get you to talk.

What you can and cannot fix

What left that payment account cannot be pulled back. If your name, claim or payment-account number, service dates, billed services, payment amounts, or other insurance policy and group numbers were in it, they are out. There is no recall, and no company can delete the copy the outsider already has.

• Use the official letter. Enroll in the monitoring and fraud support DSS is offering. That is the one remedy tied to this incident, and it is how you get help if someone later tries to open credit in your name.
• Read every HUSKY claim and every other-insurance explanation of benefits. Look for visits, tests, or bills you do not recognize. Medical billing fraud is the use that matches what was taken. Report unknown claims to HUSKY and to any other insurer on the letter.
• Do not confirm anything to anyone who contacts you first about this claimed breach, a “locked” HUSKY account, or a payment you need to “verify.” The state said it is writing by mail. Hang up and use a number you already have from a card or a prior official letter.
• Shrink the public listings that attach a phone, a home address, relatives, and past addresses to your name. A bare billing record is awkward on its own. It becomes dangerous when it is joined to people-search pages that tell a stranger how to reach you and who lives with you. Those listings, unlike the stolen file, can actually be removed. That is the lever you still have.